EUVD-2025-209124Severity by source
AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionGitHub Advisory
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow write in GET RESPONSE. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.
AnalysisAI
Stack buffer overflow in OpenSC's GET RESPONSE handler prior to version 0.27.0 allows local attackers with physical access to trigger memory corruption via specially crafted smart card or USB device responses to APDUs. The vulnerability requires user interaction and physical proximity, limiting its practical exploitability; however, it could enable local privilege escalation or information disclosure when an authorized user or administrator actively uses a token. No public exploit code or active exploitation has been confirmed.
Technical ContextAI
OpenSC is middleware for smart card and token management on desktop systems. The vulnerability exists in the GET RESPONSE APDU handler, which processes responses from smart cards or USB tokens. When a crafted token returns specially formed APDU responses, a stack buffer overflow (CWE-121) occurs, allowing an attacker to write beyond allocated stack memory boundaries. The attack surface is limited to the APDUs exchanged during token interaction; the attacker must control the physical device or perform a man-in-the-middle attack on the USB/smart card interface. Affected versions are all releases prior to 0.27.0, as identified by the CPE range cpe:2.3:a:opensc:opensc:*:*:*:*:*:*:*:* without upper-bound version.
RemediationAI
Vendor-released patch: OpenSC version 0.27.0 and later. Update from official distribution channels or rebuild from source. For users unable to upgrade immediately, limit physical access to computers during token operations and monitor for suspicious device behavior. Environment controls such as restricting USB device insertion policies and using only trusted, pre-vetted smart cards or tokens can mitigate risk. Refer to the official security advisory at https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5cf-5wmx-9wh4 for detailed remediation guidance.
sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. Rated
Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15
Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC
Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in O
A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenS
A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-r
A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0
A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs1
Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c
Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003
Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in
A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 coul
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today